@kmugalkhod/lightcode 0.16.0 → 0.17.0

package/cli.js

@@ -124,7 +124,7 @@ var init_logger = __esm(() => {
 });
 
 // packages/shared/src/version.ts
-var lightcodeVersion = "0.16.0";
+var lightcodeVersion = "0.17.0";
 
 // packages/shared/src/index.ts
 var productName = "Lightcode";
@@ -133,6 +133,90 @@ var init_src = __esm(() => {
   init_logger();
 });
 
+// packages/shared/src/network-fetch.ts
+import { readFileSync, statSync } from "fs";
+import { X509Certificate } from "crypto";
+import * as tls from "tls";
+function isCertificateError(error) {
+  const seen = new Set;
+  let current = error;
+  while (current && typeof current === "object" && !seen.has(current) && seen.size < 12) {
+    seen.add(current);
+    const record = current;
+    if (certificateErrorPattern.test(`${record.code ?? ""} ${record.message ?? ""}`))
+      return true;
+    current = record.cause;
+  }
+  return false;
+}
+function createNetworkFetch({
+  env = process.env,
+  fetchImpl
+} = {}) {
+  let cachedKey = "";
+  let cachedCa;
+  let checkedAt = 0;
+  const resolveCa = () => {
+    const paths = [
+      ...new Set([env.LIGHTCODE_CA_CERTS, env.NODE_EXTRA_CA_CERTS, env.SSL_CERT_FILE].map((value) => value?.trim()).filter((value) => Boolean(value)))
+    ];
+    const key = JSON.stringify(paths);
+    if (key === cachedKey && Date.now() - checkedAt < 30000)
+      return cachedCa;
+    const extra = [];
+    for (const file of paths) {
+      try {
+        if (statSync(file).size > 4 * 1024 * 1024)
+          throw new Error("CA bundle exceeds 4 MiB");
+        const certificates = readFileSync(file, "utf8").match(certificatePattern);
+        if (!certificates?.length)
+          throw new Error("No PEM certificates found");
+        for (const cert of certificates)
+          new X509Certificate(cert);
+        extra.push(...certificates);
+      } catch (cause) {
+        throw new Error("Cannot load configured TLS CA certificate bundle. Check LIGHTCODE_CA_CERTS, NODE_EXTRA_CA_CERTS and SSL_CERT_FILE for readable PEM files.", { cause });
+      }
+    }
+    let defaults = [...tls.rootCertificates];
+    try {
+      defaults.push(...tls.getCACertificates("default"), ...tls.getCACertificates("system"));
+    } catch {}
+    cachedCa = extra.length ? [...new Set([...defaults, ...extra])] : undefined;
+    cachedKey = key;
+    checkedAt = Date.now();
+    return cachedCa;
+  };
+  return async (input, init) => {
+    const url = new URL(input instanceof Request ? input.url : String(input));
+    const ca = url.protocol === "https:" ? resolveCa() : undefined;
+    const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    try {
+      return await (fetchImpl ?? globalThis.fetch)(input, {
+        ...init,
+        ...local && init?.proxy === undefined ? { proxy: "" } : {},
+        ...ca ? {
+          tls: {
+            ...init?.tls,
+            ca: init?.tls?.ca ?? ca,
+            rejectUnauthorized: true
+          }
+        } : {}
+      });
+    } catch (cause) {
+      if (isCertificateError(cause))
+        throw new Error(certificateErrorHint, { cause });
+      throw cause;
+    }
+  };
+}
+var certificatePattern, certificateErrorPattern, certificateErrorHint = "TLS certificate verification failed. Configure your company CA PEM with NODE_EXTRA_CA_CERTS or LIGHTCODE_CA_CERTS, then restart Lightcode. If a CA is already configured, check the server certificate hostname, expiry, and chain.", networkFetch;
+var init_network_fetch = __esm(() => {
+  certificatePattern = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+  certificateErrorPattern = /CERT_(?:HAS_EXPIRED|NOT_YET_VALID|REVOKED|UNTRUSTED|SIGNATURE_FAILURE)|CERTIFICATE_VERIFY_FAILED|UNABLE_TO_(?:GET_ISSUER_CERT(?:_LOCALLY)?|VERIFY_LEAF_SIGNATURE)|DEPTH_ZERO_SELF_SIGNED_CERT|SELF_SIGNED_CERT_IN_CHAIN|ERR_TLS_CERT_ALTNAME_INVALID|certificate|self.signed|unable to (?:get local issuer|verify the first)/i;
+  networkFetch = createNetworkFetch();
+});
+
 // apps/cli/src/lib/api-base-url.ts
 var apiBaseUrl;
 var init_api_base_url = __esm(() => {
@@ -191,7 +275,7 @@ function existingLightcodeInterfaceError(requestedInterface, port) {
 }
 async function checkServer(url) {
   try {
-    const response = await fetch(new URL("/config/status", url), {
+    const response = await networkFetch(new URL("/config/status", url), {
       signal: AbortSignal.timeout(healthCheckTimeoutMs)
     });
     if (!response.ok) {
@@ -209,7 +293,7 @@ async function checkServer(url) {
 }
 async function checkWebPort(url) {
   try {
-    const response = await fetch(new URL("/healthz", url), {
+    const response = await networkFetch(new URL("/healthz", url), {
       signal: AbortSignal.timeout(healthCheckTimeoutMs)
     });
     if (!response.ok) {
@@ -227,7 +311,7 @@ async function checkWebPort(url) {
 }
 async function checkAuthenticatedWebServer(url, token) {
   try {
-    const response = await fetch(new URL("/config/status", url), {
+    const response = await networkFetch(new URL("/config/status", url), {
       headers: { Authorization: `Bearer ${token}` },
       signal: AbortSignal.timeout(healthCheckTimeoutMs)
     });
@@ -416,6 +500,7 @@ async function ensureServerRunning() {
 }
 var currentOwnedProcess = null, healthCheckTimeoutMs = 1500, startupPollIntervalMs = 250, startupPollAttempts = 40, webPortProbeCount = 12;
 var init_server_launcher = __esm(() => {
+  init_network_fetch();
   init_api_base_url();
 });
 
@@ -2370,10 +2455,11 @@ var init_schema10 = __esm(() => {
 
 // packages/ai/src/skills/schema.ts
 import { z as z20 } from "zod";
-var skillDescription = "Load a local Lightcode skill by name and return its instructions and metadata.", skillInputSchema, skillProviderInputSchema, skillSummarySchema, skillOutputSchema, skillListOutputSchema;
+var skillDescription = "Load an installed skill by name before following its instructions. Use resource to read a supporting file relative to that skill's directory.", skillInputSchema, skillProviderInputSchema, skillSummarySchema, skillOutputSchema, skillListOutputSchema;
 var init_schema11 = __esm(() => {
   skillInputSchema = z20.object({
-    name: z20.string().min(1).max(160)
+    name: z20.string().min(1).max(160),
+    resource: z20.string().min(1).max(1024).optional()
   });
   skillProviderInputSchema = skillInputSchema;
   skillSummarySchema = z20.object({
@@ -2723,7 +2809,7 @@ var init_tool_registry = __esm(() => {
       permissionMode: "read-only",
       execution: "server",
       availability: "skills",
-      activation: "specialized",
+      activation: "core",
       outputPolicy: "artifact-if-large"
     },
     list_mcp_resources: {
@@ -3433,7 +3519,7 @@ ${environmentContext.trim()}` : "");
 var cwdPromptPlaceholder = "{cwd}", defaultCodingAgentSystemPrompt, toolCallingDisciplineAddendum;
 var init_coding_agent_prompt = __esm(() => {
   init_coding_agent_modes();
-  defaultCodingAgentSystemPrompt = "You are a coding agent working inside the user's project at this working directory: {cwd}. " + 'You can already see the project \u2014 proactively read it. When the user asks you to review, explain, or work on "my code"/"this", inspect the working directory yourself with list_files, glob_search, grep, and read_file; NEVER ask the user to paste or share code that lives in this directory \u2014 open it. ' + "Use tools for filesystem and codebase tasks instead of guessing, and only interact with files under the working directory. " + "Prefer dedicated tools \u2014 glob_search for paths, grep for text search, structured git tools for repository inspection \u2014 and bash only when those are not enough. " + `Inspect context before risky operations. Progress notes: before a major tool action you may emit ONE short note (one sentence, ~15 words) saying what you are about to do. After a tool returns, mention a finding only if it changes your plan, and state it as fact grounded in what the tool actually returned \u2014 cite the file/line/symbol. NEVER claim you found, changed, or fixed something before a tool result confirms it. Skip notes for routine reads, and do not restate the todo list in prose.
+  defaultCodingAgentSystemPrompt = "You are a coding agent working inside the user's project at this working directory: {cwd}. " + 'You can already see the project \u2014 proactively read it. When the user asks you to review, explain, or work on "my code"/"this", inspect the working directory yourself with list_files, glob_search, grep, and read_file; NEVER ask the user to paste or share code that lives in this directory \u2014 open it. ' + "Use tools for filesystem and codebase tasks instead of guessing, and only interact with files under the working directory. " + "Prefer dedicated tools \u2014 glob_search for paths, grep for text search, structured git tools for repository inspection \u2014 and bash only when those are not enough. " + "Check the available skill descriptions for every task. When a skill is explicitly named or clearly matches the task, load it with the skill tool before acting and follow its instructions within the user's scope and tool permissions. Skill files may be installed outside the workspace; use the skill tool to read their relative supporting resources. Never claim to have used a skill you have not loaded. " + `Inspect context before risky operations. Progress notes: before a major tool action you may emit ONE short note (one sentence, ~15 words) saying what you are about to do. After a tool returns, mention a finding only if it changes your plan, and state it as fact grounded in what the tool actually returned \u2014 cite the file/line/symbol. NEVER claim you found, changed, or fixed something before a tool result confirms it. Skip notes for routine reads, and do not restate the todo list in prose.
 
 ` + `Task list discipline \u2014 use the todo_write tool to keep a visible, evolving checklist:
 ` + `- Create the list FIRST. For any task with roughly three or more distinct steps, or any multi-file or multi-stage work, call todo_write as your very first action \u2014 before reading or editing \u2014 with every step listed and all of them set to pending.
@@ -4105,7 +4191,7 @@ import {
   existsSync as existsSync3,
   lstatSync,
   realpathSync,
-  statSync
+  statSync as statSync2
 } from "fs";
 function stripTrailingSeparator(value) {
   const parsed = path5.parse(value);
@@ -4155,7 +4241,7 @@ function findNearestExistingParent(absolutePath, context, input) {
 }
 function createWorkspaceContext(cwd = process.cwd()) {
   const root = nativeRealpathSync(cwd);
-  const rootStats = statSync(root);
+  const rootStats = statSync2(root);
   if (!rootStats.isDirectory()) {
     throw new Error(`Workspace root is not a directory: ${cwd}`);
   }
@@ -5715,51 +5801,74 @@ var init_runtime10 = __esm(() => {
 });
 
 // packages/ai/src/skills/runtime.ts
-import { existsSync as existsSync4, readFileSync, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync2, readdirSync as readdirSync2, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
 import os from "os";
 import path11 from "path";
-function defaultSkillRoots(cwd) {
+function defaultSkillRoots(cwd, home, env) {
   return [
     { source: "project", path: path11.join(cwd, ".lightcode", "skills") },
     { source: "project", path: path11.join(cwd, ".agents", "skills") },
-    { source: "user", path: path11.join(os.homedir(), ".lightcode", "skills") }
+    ...[".claude", ".codex", ".opencode"].map((dir) => ({
+      source: "project",
+      path: path11.join(cwd, dir, "skills")
+    })),
+    ...[".lightcode", ".agents", ".claude"].map((dir) => ({
+      source: "user",
+      path: path11.join(home, dir, "skills")
+    })),
+    {
+      source: "user",
+      path: path11.join(env.CODEX_HOME || path11.join(home, ".codex"), "skills")
+    },
+    {
+      source: "user",
+      path: path11.join(env.XDG_CONFIG_HOME || path11.join(home, ".config"), "opencode", "skills")
+    },
+    ...(env.LIGHTCODE_SKILL_PATHS ?? "").split(path11.delimiter).filter(Boolean).map((root) => ({
+      source: "user",
+      path: path11.resolve(cwd, root)
+    }))
   ];
 }
 function normalizeSkillName(value) {
   return value.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "-");
 }
 function parseBasicFrontmatter(content) {
-  if (!content.startsWith("---")) {
+  const match = /^\uFEFF?---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(content);
+  if (!match)
     return {};
-  }
-  const endIndex = content.indexOf(`
----`, 3);
-  if (endIndex === -1) {
+  const parsed = Bun.YAML.parse(match[1]);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
     return {};
-  }
-  const frontmatter = content.slice(3, endIndex).trim();
-  return Object.fromEntries(frontmatter.split(/\r?\n/).map((line) => line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/)).filter((match) => match !== null).map((match) => [
-    match[1],
-    match[2].replace(/^["']|["']$/g, "").trim()
-  ]));
+  return Object.fromEntries(Object.entries(parsed).filter((entry) => typeof entry[1] === "string"));
 }
 function findSkillFiles(root) {
-  if (!existsSync4(root.path)) {
-    return [];
-  }
   const files = [];
+  const visited = new Set;
   const visit = (directory, depth) => {
-    if (depth > 4) {
+    if (depth > 8 || visited.size >= 2000) {
       return;
     }
-    for (const entry of readdirSync2(directory)) {
+    let entries;
+    try {
+      const real = realpathSync2(directory);
+      if (visited.has(real))
+        return;
+      visited.add(real);
+      entries = readdirSync2(directory).sort();
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
       const entryPath = path11.join(directory, entry);
-      const stat3 = statSync2(entryPath);
-      if (stat3.isDirectory()) {
-        visit(entryPath, depth + 1);
-      } else if (entry.toLowerCase() === "skill.md") {
-        files.push(entryPath);
-      }
+      try {
+        const stat3 = statSync3(entryPath);
+        if (stat3.isDirectory()) {
+          visit(entryPath, depth + 1);
+        } else if (stat3.isFile() && stat3.size <= 1048576 && entry.toLowerCase() === "skill.md") {
+          files.push(entryPath);
+        }
+      } catch {}
     }
   };
   visit(root.path, 0);
@@ -5769,52 +5878,71 @@ function clearSkillsCache() {
   skillsCache.clear();
 }
 function listSkills({
-  cwd = process.cwd()
+  cwd = process.cwd(),
+  home = os.homedir(),
+  env = process.env
 } = {}) {
-  const cached = skillsCache.get(cwd);
+  const roots = defaultSkillRoots(path11.resolve(cwd), home, env);
+  const cacheKey = JSON.stringify(roots);
+  const cached = skillsCache.get(cacheKey);
   if (cached && cached.expiresAt > Date.now()) {
     return cached.skills;
   }
-  const skills = listSkillsUncached(cwd);
-  skillsCache.set(cwd, {
+  const skills = listSkillsUncached(roots);
+  if (skillsCache.size >= 100)
+    skillsCache.delete(skillsCache.keys().next().value);
+  skillsCache.set(cacheKey, {
     expiresAt: Date.now() + skillsCacheTtlMs,
     skills
   });
   return skills;
 }
-function listSkillsUncached(cwd) {
+function listSkillsUncached(roots) {
   const seen = new Set;
   const summaries = [];
-  for (const root of defaultSkillRoots(cwd)) {
+  for (const root of roots) {
     for (const skillPath of findSkillFiles(root)) {
-      const content = readFileSync(skillPath, "utf8");
-      const frontmatter = parseBasicFrontmatter(content);
-      const fallbackName = path11.basename(path11.dirname(skillPath));
-      const name = normalizeSkillName(frontmatter.name ?? fallbackName);
-      if (!name || seen.has(name)) {
-        continue;
-      }
-      seen.add(name);
-      summaries.push({
-        name,
-        description: frontmatter.description || null,
-        path: skillPath,
-        source: root.source
-      });
+      try {
+        const content = readFileSync2(skillPath, "utf8");
+        const frontmatter = parseBasicFrontmatter(content);
+        const fallbackName = path11.basename(path11.dirname(skillPath));
+        const name = normalizeSkillName(frontmatter.name ?? fallbackName);
+        if (!name || name.length > 160 || seen.has(name)) {
+          continue;
+        }
+        seen.add(name);
+        summaries.push({
+          name,
+          description: frontmatter.description || null,
+          path: skillPath,
+          source: root.source
+        });
+      } catch {}
     }
   }
   return summaries.sort((left, right) => left.name.localeCompare(right.name));
 }
-function loadSkill(input, { cwd = process.cwd() } = {}) {
+function loadSkill(input, options = {}) {
   const parsedInput = skillInputSchema.parse(input);
   const normalizedName = normalizeSkillName(parsedInput.name);
-  const skill = listSkills({ cwd }).find((candidate) => normalizeSkillName(candidate.name) === normalizedName);
+  const skill = listSkills(options).find((candidate) => normalizeSkillName(candidate.name) === normalizedName);
   if (!skill) {
     throw new Error(`Skill not found: ${parsedInput.name}`);
   }
+  const root = realpathSync2(path11.dirname(skill.path));
+  const target = parsedInput.resource ? realpathSync2(path11.resolve(root, parsedInput.resource)) : skill.path;
+  if (parsedInput.resource) {
+    const relative = path11.relative(root, target);
+    if (relative === ".." || relative.startsWith(`..${path11.sep}`) || path11.isAbsolute(relative)) {
+      throw new Error("Skill resources must stay inside the installed skill directory.");
+    }
+  }
+  const stat3 = statSync3(target);
+  if (!stat3.isFile() || stat3.size > 1048576)
+    throw new Error("Skill resource must be a file smaller than 1 MiB.");
   return skillOutputSchema.parse({
     skill,
-    content: readFileSync(skill.path, "utf8")
+    content: readFileSync2(target, "utf8")
   });
 }
 var skillsCacheTtlMs = 30000, skillsCache;
@@ -7572,7 +7700,7 @@ var init_context = __esm(() => {
 });
 
 // packages/ai/src/config/lightcode-config.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import os2 from "os";
 import path13 from "path";
 import { z as z33 } from "zod";
@@ -7583,7 +7711,7 @@ function getDefaultUserConfigPath(env) {
   return path13.join(os2.homedir(), ".lightcode", "settings.json");
 }
 function readConfigFile(scope, configPath) {
-  if (!existsSync5(configPath)) {
+  if (!existsSync4(configPath)) {
     return {
       config: {},
       file: {
@@ -7596,7 +7724,7 @@ function readConfigFile(scope, configPath) {
   }
   let rawConfig;
   try {
-    rawConfig = JSON.parse(readFileSync2(configPath, "utf8"));
+    rawConfig = JSON.parse(readFileSync3(configPath, "utf8"));
   } catch (error) {
     throw new LightcodeConfigError(`Unable to parse Lightcode config at ${configPath}: ${error instanceof Error ? error.message : "invalid JSON"}`);
   }
@@ -8051,11 +8179,11 @@ function decodeHtmlEntities(value) {
     const normalized = entity.toLowerCase();
     if (normalized.startsWith("#x")) {
       const codePoint = Number.parseInt(normalized.slice(2), 16);
-      return Number.isFinite(codePoint) ? String.fromCodePoint(codePoint) : match;
+      return Number.isInteger(codePoint) && codePoint >= 0 && codePoint <= 1114111 ? String.fromCodePoint(codePoint) : match;
     }
     if (normalized.startsWith("#")) {
       const codePoint = Number.parseInt(normalized.slice(1), 10);
-      return Number.isFinite(codePoint) ? String.fromCodePoint(codePoint) : match;
+      return Number.isInteger(codePoint) && codePoint >= 0 && codePoint <= 1114111 ? String.fromCodePoint(codePoint) : match;
     }
     return htmlEntityMap[normalized] ?? match;
   });
@@ -8082,6 +8210,34 @@ function normalizeContentToText(content, contentType) {
   return content.replace(/\r\n/g, `
 `).trim();
 }
+async function readBoundedBody(response) {
+  if (!response.body)
+    return { text: "", truncated: false };
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder;
+  let bytes = 0;
+  let text = "";
+  let truncated = false;
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      const available = maxDownloadBytes - bytes;
+      text += decoder.decode(value.subarray(0, available), { stream: true });
+      bytes += value.byteLength;
+      if (bytes >= maxDownloadBytes) {
+        truncated = true;
+        await reader.cancel();
+        break;
+      }
+    }
+    text += decoder.decode();
+    return { text, truncated };
+  } finally {
+    reader.releaseLock();
+  }
+}
 function errorOutput({
   parsedInput,
   code,
@@ -8109,7 +8265,7 @@ async function executeWebFetch(input, options = {}) {
   const timeoutSignal = AbortSignal.timeout(parsedInput.timeoutMs);
   const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
   try {
-    const response = await (options.fetch ?? globalThis.fetch)(parsedInput.url, {
+    const response = await (options.fetch ?? networkFetch)(parsedInput.url, {
       redirect: "follow",
       signal,
       headers: {
@@ -8118,7 +8274,8 @@ async function executeWebFetch(input, options = {}) {
       }
     });
     const contentType = response.headers.get("content-type");
-    const rawText = await response.text();
+    const downloaded = await readBoundedBody(response);
+    const rawText = downloaded.text;
     const normalizedText = normalizeContentToText(rawText, contentType);
     const truncated = truncateText(normalizedText, parsedInput.maxChars);
     return webFetchOutputSchema.parse({
@@ -8130,7 +8287,7 @@ async function executeWebFetch(input, options = {}) {
       contentType,
       title: contentType?.toLowerCase().includes("html") ? extractTitle(rawText) : null,
       text: truncated.text,
-      truncated: truncated.truncated,
+      truncated: truncated.truncated || downloaded.truncated,
       fetchedAt: new Date().toISOString(),
       error: response.ok ? null : {
         code: "http_error",
@@ -8145,8 +8302,9 @@ async function executeWebFetch(input, options = {}) {
     });
   }
 }
-var htmlEntityMap;
+var htmlEntityMap, maxDownloadBytes;
 var init_runtime13 = __esm(() => {
+  init_network_fetch();
   init_output_utils();
   init_schema14();
   htmlEntityMap = {
@@ -8157,10 +8315,11 @@ var init_runtime13 = __esm(() => {
     apos: "'",
     nbsp: " "
   };
+  maxDownloadBytes = 2 * 1024 * 1024;
 });
 
 // packages/ai/src/config/credentials.ts
-import { chmodSync as chmodSync2, existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
 import os3 from "os";
 import path14 from "path";
 import { z as z34 } from "zod";
@@ -8173,11 +8332,11 @@ function getCredentialsPath(env = process.env) {
 }
 function readStoredCredentials(env = process.env) {
   const credentialsPath = getCredentialsPath(env);
-  if (!existsSync6(credentialsPath)) {
+  if (!existsSync5(credentialsPath)) {
     return {};
   }
   try {
-    const parsed = storedCredentialsSchema.safeParse(JSON.parse(readFileSync3(credentialsPath, "utf8")));
+    const parsed = storedCredentialsSchema.safeParse(JSON.parse(readFileSync4(credentialsPath, "utf8")));
     return parsed.success ? parsed.data : {};
   } catch {
     return {};
@@ -8406,7 +8565,7 @@ async function executeWebSearch(input, options = {}) {
       }
       return await searchBrave(parsedInput, {
         apiKey: keys.brave,
-        fetch: options.fetch ?? globalThis.fetch,
+        fetch: options.fetch ?? networkFetch,
         signal,
         maxCharactersPerResult: config2.maxCharactersPerResult
       });
@@ -8422,7 +8581,7 @@ async function executeWebSearch(input, options = {}) {
       }
       return await searchTavily(parsedInput, {
         apiKey: keys.tavily,
-        fetch: options.fetch ?? globalThis.fetch,
+        fetch: options.fetch ?? networkFetch,
         signal,
         maxCharactersPerResult: config2.maxCharactersPerResult
       });
@@ -8463,6 +8622,7 @@ async function executeWebSearch(input, options = {}) {
 }
 var localUsesByTurn;
 var init_runtime14 = __esm(() => {
+  init_network_fetch();
   init_lightcode_config();
   init_credentials();
   init_config2();
@@ -9989,7 +10149,7 @@ var init_schema18 = __esm(() => {
 });
 
 // packages/ai/src/plugins/runtime.ts
-import { existsSync as existsSync7, readFileSync as readFileSync4, readdirSync as readdirSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync as readdirSync3 } from "fs";
 import os4 from "os";
 import path16 from "path";
 function pluginRoots(cwd) {
@@ -10001,7 +10161,7 @@ function pluginRoots(cwd) {
 function listPlugins({ cwd = process.cwd() } = {}) {
   const plugins = [];
   for (const root of pluginRoots(cwd)) {
-    if (!existsSync7(root)) {
+    if (!existsSync6(root)) {
       continue;
     }
     for (const entry of readdirSync3(root, { withFileTypes: true })) {
@@ -10009,10 +10169,10 @@ function listPlugins({ cwd = process.cwd() } = {}) {
         continue;
       }
       const manifestPath = path16.join(root, entry.name, "plugin.json");
-      if (!existsSync7(manifestPath)) {
+      if (!existsSync6(manifestPath)) {
         continue;
       }
-      const manifest = pluginManifestSchema.parse(JSON.parse(readFileSync4(manifestPath, "utf8")));
+      const manifest = pluginManifestSchema.parse(JSON.parse(readFileSync5(manifestPath, "utf8")));
       plugins.push({
         id: manifest.id,
         name: manifest.name,
@@ -10044,7 +10204,7 @@ async function runPluginHooks({
     if (!plugin.enabled) {
       continue;
     }
-    const manifest = pluginManifestSchema.parse(JSON.parse(readFileSync4(plugin.path, "utf8")));
+    const manifest = pluginManifestSchema.parse(JSON.parse(readFileSync5(plugin.path, "utf8")));
     for (const hook of manifest.hooks.filter((candidate) => candidate.event === event)) {
       hooksRun += 1;
       const child = Bun.spawn([hook.command, ...hook.args], {
@@ -10262,8 +10422,9 @@ var init_src2 = __esm(() => {
 import { hc } from "hono/client";
 var client;
 var init_client = __esm(() => {
+  init_network_fetch();
   init_api_base_url();
-  client = hc(apiBaseUrl);
+  client = hc(apiBaseUrl, { fetch: networkFetch });
 });
 
 // apps/cli/src/utils/markdown-code.ts
@@ -18100,6 +18261,7 @@ function ChatScreen() {
     status,
     todos
   } = useCodingSessionChat({
+    fetch: networkFetch,
     chatApi,
     initialPrompt,
     isSessionIdValid,
@@ -19121,6 +19283,7 @@ var autoImplementationInstruction = "Please implement the approved plan now. Exe
 var init_chat_screen = __esm(() => {
   init_src2();
   init_react();
+  init_network_fetch();
   init_runtime17();
   init_chat_slash_actions();
   init_clipboard();
@@ -21995,7 +22158,7 @@ __export(exports_register_grammars, {
   registerExtraGrammars: () => registerExtraGrammars,
   GRAMMARS: () => GRAMMARS
 });
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { join } from "path";
 import { getTreeSitterClient as getTreeSitterClient2 } from "@opentui/core";
 function resolveGrammarsDir() {
@@ -22005,7 +22168,7 @@ function resolveGrammarsDir() {
     join(import.meta.dir, "..", "..", "assets", "grammars")
   ];
   for (const dir of candidates) {
-    if (existsSync8(dir)) {
+    if (existsSync7(dir)) {
       return dir;
     }
   }
@@ -22026,7 +22189,7 @@ function registerExtraGrammars() {
   for (const grammar of GRAMMARS) {
     const wasmPath = join(dir, grammar.dir, grammar.wasm);
     const highlightsPath = join(dir, grammar.dir, "highlights.scm");
-    if (!existsSync8(wasmPath) || !existsSync8(highlightsPath)) {
+    if (!existsSync7(wasmPath) || !existsSync7(highlightsPath)) {
       continue;
     }
     try {